Cisco 300-540 Exam With Confidence Using Practice Dumps

In a cloud-scale or data center–scale environment,Virtual Extensible LAN (VXLAN)is used as anoverlay technologyto transportLayer 2 segments over a Layer 3 underlay network. VXLAN encapsulates Layer 2 Ethernet frames inside UDP/IP packets, allowing broadcast, unknown unicast, and multicast (BUM) traffic and tenant Layer 2 domains to be extended across a routed IP fabric.

Key points aligned with Cisco Service Provider Cloud Infrastructure design principles:

VXLAN creates aLayer 2 overlay on top of a Layer 3 underlay.

TheVXLAN Network Identifier (VNI)provides a much larger segmentation space than traditional VLANs, enabling multi-tenancy at cloud scale.

Because the underlay is pure Layer 3 (IP routed fabric), VXLAN allows you tointerconnect Layer 2 segments between leaf switches or data centers over an IP/MPLS backbonewithout relying on large Layer 2 domains in the physical network.

Why the options evaluate as follows:

Option A: extends Layer 2 segments across the underlying Layer 3 infrastructure✅This is the core benefit of VXLAN in cloud-scale designs. VXLAN encapsulates Layer 2 frames intoIP/UDP headers, allowing isolated Layer 2 segments (per VNI) to be stretched across a routed IP network. This enables:

Multi-tenant Layer 2 connectivity across a distributed cloud fabric

Mobility of virtual machines or containers while keeping same IP/MAC addressing

Use of an IP-based leaf–spine or service provider underlay for scalability and resiliency

Option B: extends Layer 3 segments across the underlying Layer 2 infrastructure❌This is the opposite of what VXLAN does. VXLAN is explicitlyL2-over-L3, not L3-over-L2. Extending pure Layer 3 segments over Layer 2 is not the VXLAN use case.

Option C: reduces spanning-tree complexity across the Layer 2 infrastructure⚠️(Partially related but not the primary or direct benefit)In modern designs, the underlay isLayer 3 routed, and VXLAN overlays provide logical Layer 2 segments. This designavoids dependence on spanning tree in the fabric, whichindirectlyreduces STP complexity. However, the fundamental, exam-relevant benefit isL2 extension over L3, so C is not the best or most accurate answer compared to A.

Option D: eliminates the need for a Layer 3 underlay in the service provider infrastructure❌VXLAN absolutelyrequiresan IP (Layer 3) underlay for transport. VXLAN tunnels are built over a routed infrastructure (leaf–spine, MPLS/IP core, etc.). It does not remove the need for Layer 3; it depends on it.

Phase 1 of an IPsec tunnel (ISAKMP/IKE) must havematching proposalson both peers for:

Encryption algorithm

Hash (integrity) algorithm

Authentication method

DH group

The requirement states thatAESandSHA-256must be used. The current configuration uses:

encryption 3des → incorrect (must be AES)

hash md5 → incorrect (must be SHA-256)

To meet the requirement, we must modify the ISAKMP policy:

crypto isakmp policy 10

encryption aes ← change 3DES to AES

hash sha256 ← change MD5 to SHA-256

authentication pre-share

group 12

Therefore, the necessary commands on PE1 are:

encryption aes→ optionB

hash sha256→ optionE

Options C and D are invalid syntax (encryption sha256 and hash aes are not supported). Changing the DH group (A) is not required by the problem statement and would not by itself fix the mismatch related to encryption and hash algorithms.

Comprehensive and Detailed Explanation (Cisco NFVI / Virtualization Knowledge)

SR-IOV (Single Root I/O Virtualization)allows a VM to access the network interface hardwaredirectly, without going through the hypervisor’s virtual switch.

This is achieved by:

Assigning Virtual Functions (VFs) directly to VMs

Allowing high-performance, low-latency packet I/O

Bypassing the hypervisor datapath

Therefore, SR-IOV doesnotbypass the guest OS; it bypasses thehypervisor I/O virtualization layer, delivering near-native performance.

Thus the correct answer isC.